Skip to main content

Free Mixed Content Checker

Find http files breaking the padlock on https pages.

Enter the URL of an https page and see every image, script, stylesheet, iframe, media file and CSS url() still requested over plain http. Results are split into what the browser blocks and what only costs you the padlock. No public URL yet? Paste the source instead and the scan runs in your browser.

Free, no signup Reads the real response headers Paste mode for staging pages

Padlock fixed? Keep it that way

Mixed content usually starts with the hosting setup.

Grigora issues and renews certificates for you and serves every page, image, form and store asset over https by default, so the only way http creeps back in is a third party embed you pasted yourself.

Start free See the builder

How to check a page for mixed content

Four steps from view source to a clean padlock.

1

Enter the page URL

Any public http or https page. The scan reads the HTML the server actually sends, along with its security headers.

2

Or paste the source

For staging builds, local files and pages behind a login, paste the markup instead. That scan stays in your browser.

3

Read the two groups

Active findings are blocked by the browser. Passive findings load but break the padlock.

4

Rewrite and re-check

Change each http URL to https, confirm the host serves it there, then run the scan again.

How to check for mixed content, step by step

Real screenshots of the current tool, using sample inputs. Long results are shown as a preview.

  1. 1

    Enter the page URL

    Or switch to the paste tab and check a template that is not published yet.

    Free Mixed Content Checker in its default state before the walkthrough
  2. 2

    Choose the page to scan

    Start with the pages carrying the most third party embeds. That is where an http reference usually hides.

    Free Mixed Content Checker with sample input or settings in place
  3. 3

    Review the result

    Select Check mixed content to run the tool. This screenshot shows the result returned for the sample input.

    Free Mixed Content Checker showing its actual result with sample inputs

When to run this check

Six moments an http subresource is the likely culprit.

The padlock disappeared

Find the one image or iframe that turned a secure page into a neutral one.

After moving a site to https

Old absolute http URLs survive migrations inside content, themes and widgets.

A widget stopped rendering

Blocked active content fails silently, so an empty box is often mixed content.

Auditing a third party embed

Ad tags and chat scripts sometimes pull assets over http from their own hosts.

Before enabling HSTS

Clear the insecure requests first, so nothing breaks when downgrades stop working.

Checking a template or theme

Hardcoded http asset URLs in a theme repeat on every page that uses it.

Fixing it on your platform

Where http URLs usually hide, by platform.

WordPress

  1. Run a search and replace across posts for http://yourdomain.
  2. Check theme and plugin files for hardcoded http asset URLs.
  3. Re-copy the source and scan again.

Shopify

  1. Open the theme code editor and search assets for http://.
  2. Check custom Liquid sections and any embedded scripts.
  3. Preview the page, view source, paste it here.

Grigora

  1. Every site, form and store asset is served over https by default.
  2. Only pasted third party embeds can introduce http URLs.
  3. Scan a published page to confirm the embed is clean.

Static or custom builds

  1. Grep the build output for the string http:// in src and href.
  2. Check CSS files for url() and @font-face entries.
  3. Add upgrade-insecure-requests to your CSP header.

Grigora vs. other ways to find mixed content

Side by side.

CapabilityGrigoraBrowser consoleOnline scannersCrawler suites
Sends your HTML anywhereNo, parsed in browserNoYes, uploadedYes, uploaded
Separates active from passiveYes, with reasonsMixed in the logSometimesYes
Checks url() inside CSSYesOnly if requestedRarelyYes
Works on a staging or local pageYes, paste the sourceYesNo, needs public URLNo, needs public URL
Signup requiredNoNoOftenYes

Common errors and how to fix them

Eight things that break a padlock, and what to change.

Blocked loading mixed active content

Cause: A script, stylesheet or iframe requested over http.

Fix: Rewrite the URL to https. If the host has no certificate, self host the file or drop it.

Padlock replaced by a neutral icon

Cause: An image, video or audio file over http.

Fix: Serve the media over https from your own domain or a CDN that supports it.

Hardcoded http in the database

Cause: Old posts store absolute http URLs in their content.

Fix: Run a search and replace across content for http://yourdomain to https://yourdomain.

A base tag poisoning every path

Cause: A base href pointing at http.

Fix: Remove the base tag or point it at https. It rewrites every relative URL on the page.

Fonts falling back to Times

Cause: An @font-face src over http, which counts as blockable.

Fix: Update the font URL to https, or host the font files with the rest of your assets.

Background image missing the padlock

Cause: A url() in a style block or style attribute over http.

Fix: CSS URLs are easy to miss because they are not in the markup. Update them too.

Form warning before submit

Cause: A form action pointing at http.

Fix: Post to the same https origin. Browsers warn the visitor and disable autofill otherwise.

Nothing found but the padlock is still off

Cause: The insecure request comes from JavaScript at runtime, not the HTML.

Fix: Open the Network panel, filter by http and reload. Fetch and XHR calls are not in the source.

Mixed content in four numbers

The rules worth remembering before you start editing.

2
Severity classes in the spec: blockable and optionally blockable
0
Active http subresources a modern browser will load on an https page
1
CSP directive that fixes most of it: upgrade-insecure-requests
0
Bytes uploaded when you paste the source, that scan stays in your browser

Frequently asked questions

Ten answers about mixed content and https.

Mixed content is any subresource an https page loads over plain http.
Active, called blockable in the specification, covers scripts, stylesheets, fonts, frames and plugin data. Browsers refuse to load it.
Use the URL for anything published.
Open the page and press Ctrl+U on Windows or Cmd+Option+U on a Mac, then select all and copy. You can also right click and choose View Page Source.
Indirectly. Google treats https as a signal, and blocked scripts and stylesheets can stop the rendered page from matching what you intended, which affects what gets indexed.
No. A URL that starts with two slashes inherits the scheme of the page, so it resolves to https on an https page. It is not flagged here. Writing the full https URL is still clearer for anyone reading the markup later.
It is a Content Security Policy directive that tells the browser to rewrite every http subresource request on the page to https before sending it.
The scan reads the HTML you served. Requests created later by JavaScript, such as fetch, XHR, dynamically inserted script tags or WebSocket connections over ws, are not in that HTML.
No. An anchor is a navigation, not a subresource, so an http link does not affect the padlock on the current page. It does send the visitor to an unencrypted page, which is worth fixing for its own reasons.
Store asset URLs without a hardcoded scheme, add upgrade-insecure-requests to your policy, and use a platform that serves every asset over https by default.

Related free tools

Other utilities that pair with the Mixed Content Checker.

Broken Link Checker

Find links on a page that no longer resolve.

Try it

Redirect Checker

Follow a redirect chain and see every hop.

Try it

Canonical Checker

Confirm a page points at the canonical URL you expect.

Try it

Accessibility Checker

Check markup for common accessibility problems.

Try it

Page Performance Checker

Spot the weight and requests slowing a page down.

Try it

Website Launch Checklist

Work through what to verify before a site goes live.

Try it

SSL Checker

Check the certificate, expiry and HTTPS redirect for a domain and its www twin.

Try it

Https on every page, without the maintenance

Site, newsletter and store on one platform, with certificates handled for you. Try it free for 14 days, no card needed.

Start building free